Description
GeoTools 库使用 Eclipse XSD 库来处理 XML 数据，但未正确配置 EntityResolver，导致 XML 外部实体 (XXE) 漏洞。当 GeoServer 或 GeoNetwork 调用 GeoTools 库处理 XML 数据时，攻击者可以注入恶意的 XML 实体，从而读取本地文件或发起其他攻击。
GeoServer /geoserver/wfs XML 外部实体注入漏洞（CVE-2025-30220）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-30220
https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc
https://geoserver.org/vulnerability/2025/06/10/cve-disclosure.html
https://cloud.tencent.com/developer/article/2549776
https://kudelskisecurity.com/research/xml-external-entity-xxe-processing-vulnerability-in-geoserver-wfs-service-cve-2025-30220
https://cve.imfht.com/detail/CVE-2025-30220
https://www.sentinelone.com/vulnerability-database/cve-2025-30220/
https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities
https://ddpoc.com/DVB-2025-9403.html